 Willi Ballenthin
|
b96b279d81
|
check-mutex: fix author
|
2022-06-06 13:17:54 -06:00 |
|
|
Willi Ballenthin
|
88c9c786ca
|
*: use meta.authors everywhere
|
2022-05-26 11:56:31 -06:00 |
|
|
William Ballenthin
|
d43a6ee544
|
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
This reverts commit bc28847dd9, reversing
changes made to 82308c4109.
|
2022-04-27 06:23:36 -06:00 |
|
|
William Ballenthin
|
a2f11828f1
|
Revert "check mutex: fix moritz email address"
This reverts commit cddf623c72.
|
2022-04-27 05:34:38 -06:00 |
|
|
Willi Ballenthin
|
cddf623c72
|
check mutex: fix moritz email address
|
2022-04-06 13:26:37 -06:00 |
|
|
Willi Ballenthin
|
904bf3ef00
|
*: remove /x32 and /x64 flavors and use instruction scope
|
2022-04-05 12:25:14 -06:00 |
|
|
Michael Hunhoff
|
58de40c15f
|
update enumerate-services
|
2022-03-23 17:04:59 -06:00 |
|
|
Michael Hunhoff
|
94f1639cb4
|
update hijack-thread-execution.yml to match additional scenarios
|
2022-03-23 09:01:25 -06:00 |
|
|
Baptistin Boilot
|
95e7bc8496
|
Update MBC names and IDs with the latest release
|
2022-02-06 11:27:09 +01:00 |
|
|
Baptistin Boilot
|
efea9a37d9
|
Fix MBC names and IDs
|
2022-02-06 11:13:23 +01:00 |
|
|
Baptistin Boilot
|
4f4914d572
|
Fix Mitre Att&ck technique naming
|
2022-01-22 16:59:27 +01:00 |
|
|
Willi Ballenthin
|
1b389db7a5
|
Merge pull request #513 from jtothej/mapping-injection
Adding inject-shellcode-using-mapping-injection.yml
|
2021-12-14 14:46:04 -07:00 |
|
|
Willi Ballenthin
|
c5d34ee255
|
Update host-interaction/bootloader/manipulate-boot-configuration.yml
|
2021-12-14 14:44:54 -07:00 |
|
|
Desiree Beck
|
ed3661b379
|
add mbc and att&ck tags
|
2021-12-14 16:16:07 -05:00 |
|
|
jtothej
|
bffb8e1233
|
Renaming inject-shellcode-using-mapping-injection.yml
|
2021-12-14 10:44:32 +08:00 |
|
|
jtothej
|
b70a876a26
|
Adding inject-shellcode-using-mapping-injection.yml
|
2021-12-12 16:07:58 +08:00 |
|
|
Ryan Xu
|
4178c9f3a9
|
Update host-interaction/bootloader/manipulate-boot-configuration.yml
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
|
2021-11-24 11:53:11 -05:00 |
|
|
Ryan Xu
|
607a06e184
|
Adding changes suggested by Mandiant
|
2021-11-23 09:01:53 -05:00 |
|
|
Desiree Beck
|
e190179ffd
|
Merge pull request #1 from MBCProject/ryan-patches1
Update patch-process-command-line.yml
|
2021-11-22 11:27:15 -05:00 |
|
|
Ryan Xu
|
e61a31966e
|
Update manipulate-boot-configuration.yml
Resolving comment
|
2021-11-12 09:01:41 -06:00 |
|
|
Michael Hunhoff
|
d1e2ce3306
|
add additional APIs to shutdown-system.yml
|
2021-11-01 15:06:17 -06:00 |
|
|
Willi Ballenthin
|
abe6402a55
|
manipulate safe mode programs: restrict to windows
|
2021-10-25 12:47:43 -06:00 |
|
|
William Ballenthin
|
fe1aa57334
|
fix lint problems
|
2021-10-22 13:42:00 -06:00 |
|
|
William Ballenthin
|
4bfc6621d3
|
add identify system language via API
closes #481
|
2021-10-22 13:27:01 -06:00 |
|
|
William Ballenthin
|
8b8b584e2d
|
injection: add ATT&CK Reflective Code Loading
closes #477
|
2021-10-22 12:43:30 -06:00 |
|
|
William Ballenthin
|
4b37c32a33
|
add manipulate safe mode programs
|
2021-10-22 12:34:58 -06:00 |
|
|
William Ballenthin
|
bedfba7abe
|
enumerate domain computers via LDAP: add references to COM GUIDs
|
2021-10-22 11:08:40 -06:00 |
|
|
William Ballenthin
|
f455c11cf4
|
append data to clfs log container: remove example that didn'tm atch
|
2021-10-22 10:54:46 -06:00 |
|
|
William Ballenthin
|
3b249f9bb6
|
set environment variable: update example
|
2021-10-15 14:52:10 -06:00 |
|
|
William Ballenthin
|
7bbbed8365
|
accept-command-line-arguments: update example
|
2021-10-15 14:22:37 -06:00 |
|
|
William Ballenthin
|
d6b9297298
|
accept-command-line-argument: remove missing example
|
2021-10-15 14:18:58 -06:00 |
|
|
Moritz Raabe
|
25938ca10c
|
change to mandiant.com
|
2021-09-28 12:21:11 +02:00 |
|
|
Ryan Xu
|
0114138ae4
|
More detailed mappings
|
2021-08-31 11:34:09 -05:00 |
|
|
William Ballenthin
|
f6b9564332
|
*: fix ntdll/ntoskrnl lints
|
2021-08-26 17:52:24 -06:00 |
|
|
William Ballenthin
|
c0fa8a2318
|
linux: add examples
|
2021-08-26 17:48:20 -06:00 |
|
|
William Ballenthin
|
cf08e8f80c
|
Merge branch 'os-linux-rules' of github.com:fireeye/capa-rules into os-linux-rules
|
2021-08-25 16:45:44 -06:00 |
|
|
Willi Ballenthin
|
55fc4f0be6
|
Update host-interaction/file-system/change-file-permission-on-linux.yml
Co-authored-by: mike-hunhoff <mike.hunhoff@gmail.com>
|
2021-08-25 16:41:03 -06:00 |
|
|
William Ballenthin
|
32fed5f55b
|
fix lints
|
2021-08-25 15:49:51 -06:00 |
|
|
William Ballenthin
|
ea3ea14c22
|
minor reorg linux rules and logic
ref #442
|
2021-08-25 15:31:51 -06:00 |
|
|
Willi Ballenthin
|
6f582bd395
|
Merge pull request #442 from TcM1911/linux-rules
A set of rules for Linux ELFs
|
2021-08-25 14:33:25 -06:00 |
|
|
William Ballenthin
|
0ef69c4fbd
|
*: use substring features rather than unreadable regexes
closes #450
|
2021-08-24 12:47:26 -06:00 |
|
|
MalwareMechanic
|
1826309f9d
|
add rules for reading and appending to a CLFS log container
|
2021-08-24 11:27:53 -04:00 |
|
|
Ryan Xu
|
b4e040dc50
|
preliminary mapping
|
2021-08-23 14:11:00 -05:00 |
|
|
Willi Ballenthin
|
cfb95cf5c9
|
Merge pull request #422 from fireeye/pma-2021-06-30
adding rules based on more PMA labs
|
2021-08-18 14:46:21 -06:00 |
|
|
William Ballenthin
|
39e87e6cb4
|
execute-command: use better example
|
2021-08-18 14:45:48 -06:00 |
|
|
Joakim Kennedy
|
654f784771
|
Address PR comments
|
2021-08-11 13:58:25 +01:00 |
|
|
Joakim Kennedy
|
776bcd34dd
|
Move rules without examples to nursery
|
2021-08-05 15:52:17 +01:00 |
|
|
Joakim Kennedy
|
b8d4b0cf0c
|
A few more lint fixes
|
2021-08-05 15:48:48 +01:00 |
|
|
Joakim Kennedy
|
78fbf5f3c5
|
Fix linting errors
|
2021-08-05 15:35:27 +01:00 |
|
|
Joakim Kennedy
|
765e182553
|
A set of rules for Linux ELFs
|
2021-08-04 15:47:00 +01:00 |
|